- On any network, security controls are needed
on multiple levels as without a layered approach,
you could be victim of an attack.
Passive attacks are things such as traffic sniffing
or scanning, and these are done during reconnaissance
to discover information about a network.
Active attacks are designed to interrupt service,
destroy data, or steal information.
Here we see a depiction of the seven-layer OSI model.
There is a potential for attacks
in every layer of the OSI model.
We'll take one more step and separate this
and I'll show you that the first two layers,
layer one and layer two, are essentially hardware attacks.
Layers three through seven are more directed
at software attacks.
So now let's go through each layer
starting at layer seven, the application layer.
The application layer is where we initiate contact
with the network.
Attacks can include software attacks
and these are designed to exploit some weakness in the code.
There could be phishing via email or popups,
and malware such as viruses, ransomware, trojans, and worms.
The presentation layer is where the data
is presented to the application so we can view it.
Attacks include forced browsing
and this is also called a failure to restrict URL access.
Now this will allow access to authenticated areas
without proper credentials.
And then there's an SSL/TLS strip.
Now, this is a man-in-the-middle attack
where a malicious actor is between a client and a server.
Here we see the attacker in the middle
and the malicious actor will monitor, capture,
and control the communication
with the goal of obtaining sensitive information
such as usernames and passwords.
The session layer is responsible for initiating,
maintaining, and tearing down a session.
A couple of attacks can take place at this layer.
Session hijacking is also known as cookie hijacking.
It grabs the session key to gain access to the services.
A session initiation protocol or SIP flood
is where clients are flooded with multiple invite messages
in order to take down the phone, and a DNS poison attack,
and now this is where fake address records are inserted
into the DNS cache so that any request for the address
are answered with a fake IP address.
The transport layer is responsible
for transportation of the data.
At the transport layer,
there are a few attacks that include port scanning.
This is simply a reconnaissance attack
to see what ports are open and listening,
and a SYN flood, now this floods the server
with multiple SYN packets with no final acknowledgement.
The result is that it overwhelms the server
so that legitimate users are locked out.
The network layer is responsible for addressing and routing.
In this layer, we can see the following;
we can see operating system fingerprinting using ICMP,
now, this again is a passive attack
to determine the operating system of the host.
There could be routing attacks
which are done to misdirect traffic,
an IP spoofing attack is where data appears
to be coming from another source,
a replay attack is where a malicious actor
intercepts credentials and then uses the credentials
to gain access to a protected resource.
And there are numerous ICMP attacks, such as a smurf attack
which is a distributed denial-of-service attack.
At the data link layer, this is where the data
is ready to be transmitted onto the network.
Here we could see the following;
we can see network sniffing, which is simply eavesdropping
and this is common in a local area network.
WPA cracking, which is done on a wireless network
to decrypt the encrypted packets,
and ARP cache poisoning, which is used
in a man-in-the-middle attack.
Now, the physical layer is really simply a physical attack
and that can include theft of devices, cutting cables,
or a skimming attack where someone attaches a device
to an ATM or point of sales system
to gather credit card numbers.
On a network, security controls are needed
on multiple levels as an attack can happen
at every layer of the OSI model.
(gentle upbeat music)